Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: github/codeql
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 709a4a3
Choose a base ref
...
head repository: github/codeql
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 60f7b90
Choose a head ref
  • 5 commits
  • 76 files changed
  • 3 contributors

Commits on Jun 2, 2026

  1. Python: inline init_module_submodule_defn into ImportResolution 

    The new-dataflow ImportResolution module only used
semmle.python.essa.SsaDefinitions for the 5-line helper predicate
SsaSource::init_module_submodule_defn. Inline it locally and drop the
dependency on legacy SsaDefinitions. This is the only remaining direct
import of semmle.python.essa.* in the new dataflow stack, so dropping
it makes the layering cleaner.

Semantic noop on the current SSA: SsaSourceVariable.getName() and
GlobalVariable.getId() both project the same DB column
(variable(_,_,result)), and the old call's 'init.getEntryNode() = f'
join was just constraining init = package via Scope.getEntryNode()'s
functional uniqueness. RA dump of accesses.ql confirms only the
expected predicate-rename shuffle; all 70 dataflow + ApiGraphs library
tests pass.

This factors out commit 8cab5a2 from the larger shared-CFG
migration #21925.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @yoff
    yoff and Copilot committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    ac5fa62 View commit details
    Browse the repository at this point in the history

  2. Python: remove AstNode.getAFlowNode() and rewrite callers 

    Preparatory refactor for the shared-CFG dataflow migration.

Removes the AstNode.getAFlowNode() cached predicate from the public
Python QL API. All ~140 callers across lib/, src/, test/, and tools/
are rewritten from `expr.getAFlowNode() = cfgNode` to
`cfgNode.getNode() = expr`, using ControlFlowNode.getNode() which
already exists in Flow.qll.

Semantic noop verified by:
- All 361 lib/ + src/ queries compile clean.
- All 122 ControlFlow + PointsTo library-tests pass.
- All 64 dataflow library-tests pass.
- All 113 Variables/Exceptions/Expressions/Statements/Functions/Imports/
  Security/CWE-798/ModificationOfParameterWithDefault query-tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @yoff
    Copilot authored and yoff committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    daea0b4 View commit details
    Browse the repository at this point in the history

  3. Python: remove Function.getAReturnValueFlowNode() and rewrite callers 

    Follow-up to the getAFlowNode removal in the same PR: same AST→legacy-CFG
bridge pattern. Rewrite the 11 call sites (across objects/, types/,
frameworks/, and TypeTrackingImpl) to bind a `Return ret` explicitly,
then constrain via `ret.getScope() = f and n.getNode() = ret.getValue()`.

Semantic noop.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @yoff
    yoff and Copilot committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    e59907f View commit details
    Browse the repository at this point in the history

  4. Python: qualify Flow.qll's AST references with Py:: prefix 

    Preparatory refactor for the shared-CFG dataflow migration. Switches
'import python' to 'import python as Py' inside Flow.qll, and qualifies
every AST-class reference (Expr, Bytes, Dict, AssignExpr, Compare,
Module, Scope, Call, Attribute, SsaVariable, AugAssign, etc.) with the
Py:: prefix.

Flow.qll's own CFG types (ControlFlowNode, BasicBlock, CallNode,
NameNode, DefinitionNode, CompareNode, ...) keep their unqualified
names — they remain the public CFG API exported from this file.

This is a semantic noop: the qualification was applied mechanically by
script and no name resolution changes. Verified by:
- All 361 lib/ + src/ queries compile clean.
- All 186 ControlFlow + PointsTo + dataflow library-tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
    @yoff
    Copilot authored and yoff committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    13e93e0 View commit details
    Browse the repository at this point in the history

  5. Apply suggestions from code review 

    Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
    @yoff
    yoff and Copilot committed Jun 2, 2026
    Configuration menu
    Copy the full SHA
    60f7b90 View commit details
    Browse the repository at this point in the history
Loading